NAT Concepts for Private Subnets
By the end of this lesson, you'll be able to:
- Explain why a private workload might still need outbound internet access
- Describe how NAT allows outbound-initiated connections while blocking new inbound ones
- Explain why NAT is not a substitute for a Security Group or a firewall policy
Prerequisites: "Route Tables and the Internet Gateway"
Why a private resource still needs the internet sometimes
A private subnet's whole point is no direct inbound route from the internet (Lesson 2). But resources inside it still often need to reach out — installing operating system or package updates, or calling an external, third-party API are two ordinary, ongoing examples. Without any outbound path at all, that private resource would be stuck.
NAT: outbound yes, inbound-initiated no
NAT (Network Address Translation) architecture provides exactly this: a private resource can initiate an outbound connection through NAT and an Internet Gateway out to the internet, and the response to that connection is allowed back in — but the internet cannot use that same path to initiate a brand-new inbound connection to the private resource.
What NAT is not
This is worth stating directly, because it's a common beginner mix-up: NAT is not a Security Group, and it is not a firewall policy. NAT shapes which direction a connection can be initiated from — it doesn't decide which ports, protocols, or sources are allowed the way a Security Group does (Module 3, and next lesson here). A private resource behind NAT can still need a correctly configured Security Group; NAT alone doesn't replace that layer of control.
Exercise
A private EC2 workload needs outbound internet access for software updates but should not accept any direct inbound connection initiated from the internet. Based on this lesson, which architecture fits — and why would relying on a public subnet with a public IP instead fail to meet the "no direct inbound" requirement?
Show hint
A public subnet with a public IP would also allow inbound connection attempts — the opposite of what this scenario needs.
NAT Concepts for Private Subnets Quiz
My Notes
Log in to keep private notes on this lesson.
Questions about this lesson
No questions yet — be the first to ask.
Log in to ask a question about this lesson.
Summary
NAT lets a resource in a private subnet initiate an outbound connection to the internet — for example, to download software updates or call an external API — while still preventing the internet from initiating a new inbound connection directly to that resource, and it is not a replacement for a Security Group or firewall policy.